PE-sieve
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
|
The API: definitions of the exported elements that are accessible from PE-sieve DLL. More...
Go to the source code of this file.
Macros | |
#define | PESIEVE_API __declspec(dllexport) |
#define | PESIEVE_API_FUNC PESIEVE_API __cdecl |
Typedefs | |
typedef t_report | PEsieve_report |
typedef t_params | PEsieve_params |
typedef t_report_type | PEsieve_rtype |
Functions | |
void PESIEVE_API_FUNC | PESieve_help (void) |
Shows a MessageBox with the informations about PE-sieve. | |
PEsieve_report PESIEVE_API_FUNC | PESieve_scan (IN const PEsieve_params &args) |
Performs a PE-sieve scan with a supplied set of parameters (defined as a structure t_params). Returns a summary of the scan in a variable of type t_report. | |
PEsieve_report PESIEVE_API_FUNC | PESieve_scan_ex (IN const PEsieve_params &args, IN const PEsieve_rtype rtype, OUT char *json_buf, IN size_t json_buf_size, OUT size_t *buf_needed_size) |
Performs a PE-sieve scan with a supplied set of parameters (defined as a structure t_params). Returns a summary of the scan in a variable of type t_report. Allows to supply a buffer that will be filled with full JSON report. | |
Variables | |
const DWORD PESIEVE_API | PESieve_version |
PE-sieve version in a DWORD form. | |
The API: definitions of the exported elements that are accessible from PE-sieve DLL.
Definition in file pe_sieve_api.h.
#define PESIEVE_API __declspec(dllexport) |
Definition at line 13 of file pe_sieve_api.h.
#define PESIEVE_API_FUNC PESIEVE_API __cdecl |
Definition at line 21 of file pe_sieve_api.h.
typedef t_params PEsieve_params |
Definition at line 40 of file pe_sieve_api.h.
typedef t_report PEsieve_report |
Definition at line 39 of file pe_sieve_api.h.
typedef t_report_type PEsieve_rtype |
Definition at line 41 of file pe_sieve_api.h.
void PESIEVE_API_FUNC PESieve_help | ( | void | ) |
Shows a MessageBox with the informations about PE-sieve.
Definition at line 74 of file pe_sieve_api.cpp.
PEsieve_report PESIEVE_API_FUNC PESieve_scan | ( | IN const PEsieve_params & | args | ) |
Performs a PE-sieve scan with a supplied set of parameters (defined as a structure t_params). Returns a summary of the scan in a variable of type t_report.
Definition at line 69 of file pe_sieve_api.cpp.
PEsieve_report PESIEVE_API_FUNC PESieve_scan_ex | ( | IN const PEsieve_params & | args, |
IN const PEsieve_rtype | rtype, | ||
OUT char * | json_buf, | ||
IN size_t | json_buf_size, | ||
OUT size_t * | buf_needed_size ) |
Performs a PE-sieve scan with a supplied set of parameters (defined as a structure t_params). Returns a summary of the scan in a variable of type t_report. Allows to supply a buffer that will be filled with full JSON report.
|
extern |
PE-sieve version in a DWORD form.